> btw: isn't the scheme you posted vulnerable to replay attacks too? Much easier than the timing attack. Yep, probably. In fact now that I look at it definitel

> btw: isn't the scheme you posted vulnerable to replay attacks too? Much easier than the timing attack. Yep, probably. In fact now that I look at it definitely, I should have gone with that instead! I forget who said this but basically any feature that exists in TLS that doesn't exist in your hand-rolled authentication scheme is a vulnerability.